Preventing write-access to NFC tag

[Jazz66]

I'm using Mifare 1k NFC tags to launch a MIDlet, but having written my own record to these tags (using javax.microedition.contactless.ndef.NDEFMessage and javax.microedition.contactless.ndef.NDEFTagConnection), I need to be able to lock them to prevent the data being overwritten. Can anyone tell me how or point me at some documentation? I keep seeing references to this being possible, but I can't find out how to do it.

Thanks!
Jazz

[tboufflet]

Hello Jazz,

http://discussion.forum.nokia.com/fo.../t-107291.html

I read somewhere that you should set KeyB to a secret key to protect your tag.

Hope this will be usefull.

Thierry

[Jazz66]

Thanks very much for your reply, Thierry - looks like this is the right track.

Jazz

[Jazz66]

I found out how to make a Mifare tag read-only, in case anyone else is interested, firstly using a Pegoda card reader (with thanks to Tuomas Partanen), and secondly using the 6131 SDK:

1. Using the Pegoda
First, write your NDEF content to the tag, then use the MifareWnd application to write the access bits. First you need to set the Mifare keys. Go to "Options > Settings". Define the keys in "Keys + Keysets" tab and then accordingly change the parameters in "Command parameter" tag. After this in Mifare UI press "Load keys" enclosed in "Reader commands" area. NDEF keys are D3F7D3F7D3F7 except for the sector 0 where keyA is A0A1A2A3A4A5.

Then, set block to 003 (the first sector trailer block)
1.) put a tag on the reader
2.) Press Request
3.) Press Anticollision (topmost)
4.) Press Select (next to anticollision, topmost)
5.) Press Auth KeyB
6.a) Press Read > You should get hex data in the "Read/Write" area. Overwrite this data with the correct bytes
A0A1A2A3A4A5078F0FC1D3D7D3D7D3D7 in the first sector, and D3D7D3D7D3D7078F0F40D3D7D3D7D3D7 thereafter. (Those bytes are KeyA, access bits, KeyB concatenated).
6.b) Press Write > Write the data set in the hex data in the "Read/Write" area

2. Using the SDK.
The following code seems to work (although it's only had a brief test), on the 6131NFC with firmware 5.12 (necessary for the MFStandardConnection implementation). To create the record I'm loading some XML from a text file in the /res directory.

It will write an NDEF record first using NDEFTagConnection, then write the access bits to secure it using MFStandardConnection.


import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;
import javax.microedition.contactless.*;
import javax.microedition.contactless.ndef.NDEFMessage;
import javax.microedition.contactless.ndef.NDEFRecord;
import javax.microedition.contactless.ndef.NDEFRecordListener;
import javax.microedition.contactless.ndef.NDEFRecordType;
import javax.microedition.contactless.ndef.NDEFTagConnection;
import javax.microedition.io.Connection;
import javax.microedition.io.Connector;
import javax.microedition.lcdui.*;
import javax.microedition.midlet.MIDlet;
import javax.microedition.midlet.MIDletStateChangeException;
import com.nokia.nfc.nxp.mfstd.MFBlock;
import com.nokia.nfc.nxp.mfstd.MFKey;
import com.nokia.nfc.nxp.mfstd.MFSector;
import com.nokia.nfc.nxp.mfstd.MFSectorTrailer;
import com.nokia.nfc.nxp.mfstd.MFStandardConnection;
import com.nokia.nfc.nxp.mfstd.MFTrailerContents;

public class SecureWriter extends MIDlet implements TargetListener, NDEFRecordListener, CommandListener {
private DiscoveryManager dm;
private Form form;
private Command secureCommand;
private Command writeCommand;
private boolean secure = false;
private boolean write = true;
private static final byte[] DEFAULT_PUBLIC_NDEF_KEY = { (byte) 0xd3, (byte) 0xf7, (byte) 0xd3, (byte) 0xf7,
(byte) 0xd3, (byte) 0xf7 };
private static final byte[] DEFAULT_SECTOR_MAD = { (byte) 0xa0, (byte) 0xa1, (byte) 0xa2, (byte) 0xa3, (byte) 0xa4,
(byte) 0xa5, (byte) 0x07, (byte) 0x8F, (byte) 0x0F, (byte) 0xc1, (byte) 0xd3, (byte) 0xf7, (byte) 0xd3,
(byte) 0xf7, (byte) 0xd3, (byte) 0xf7 };
private static final byte[] DEFAULT_SECTOR_NDEF = { (byte) 0xd3, (byte) 0xf7, (byte) 0xd3, (byte) 0xf7,
(byte) 0xd3, (byte) 0xf7, (byte) 0x07, (byte) 0x8F, (byte) 0x0F, (byte) 0x40, (byte) 0xd3, (byte) 0xf7,
(byte) 0xd3, (byte) 0xf7, (byte) 0xd3, (byte) 0xf7 };
private static final MFKey.KeyA KEY_A;
static {
KEY_A = new MFKey.KeyA( DEFAULT_PUBLIC_NDEF_KEY );
}

protected void startApp() throws MIDletStateChangeException {
dm = DiscoveryManager.getInstance();
try {
// Register NDEF tag to target listener..
dm.addTargetListener( this, TargetType.NDEF_TAG );
dm.addNDEFRecordListener( this, new NDEFRecordType( NDEFRecordType.MIME,
"application/xml; charset=\"utf-8\"" ) );
} catch ( IllegalStateException e ) {
form.append( e.toString() );
} catch ( ContactlessException e ) {
form.append( e.toString() );
}
form = new Form( "Form" );
writeCommand = new Command( "Write NDEF", Command.OK, 1 );
secureCommand = new Command( "Secure Tag", Command.OK, 1 );
form.addCommand( writeCommand );
form.setCommandListener( this );
Display.getDisplay( this ).setCurrent( form );
}

protected void pauseApp() {
}

protected void destroyApp( boolean arg0 ) throws MIDletStateChangeException {
}

private void writeNDEFRecord( NDEFTagConnection conn ) throws Exception {
InputStream is = getClass().getResourceAsStream( "/res/uTAG-BF00001" );
ByteArrayOutputStream baos = new ByteArrayOutputStream();
int c = 0;
while ( (c = is.read()) != -1 ) {
baos.write( c );
}
// Create NDEF Record to be added to NDEF Message
NDEFRecord recordToWrite = new NDEFRecord( new NDEFRecordType( NDEFRecordType.MIME,
"application/xml; charset=\"utf-8\"" ), null, baos.toByteArray() );
// Create NDEF Message and add created record in it.
NDEFMessage message = new NDEFMessage();
message.appendRecord( recordToWrite );
conn.writeNDEF( message );
}

private void secureTag( MFStandardConnection conn ) throws Exception {
MFBlock block = null;
for ( int i = 0; i < 64; i++ ) {
block = conn.getBlock( i );
System.out.println( "--- BLOCK " + i + " ---" );
if ( block.getBlockType() == MFBlock.BLOCKTYPE_TRAILER ) {
MFSectorTrailer sectorTrailer = (MFSectorTrailer) block;
if ( i == 3 ) {
sectorTrailer.writeTrailerContents( KEY_A, new MFTrailerContents( DEFAULT_SECTOR_MAD ) );
} else {
sectorTrailer.writeTrailerContents( KEY_A, new MFTrailerContents( DEFAULT_SECTOR_NDEF ) );
}
}
// showSectorData( conn );
}
}

public void targetDetected( TargetProperties[] properties ) {
System.out.println( "========= TARGET DETECTED ==========" );
Connection conn = null;
try {
if ( secure ) {
form.append( "\nSecuring tag..\n" );
Class[] propConnections = properties[0].getConnectionNames();
conn = Connector.open( properties[0].getUrl( propConnections[1] ) );
secureTag( ((MFStandardConnection) conn) );
form.append( "Tag secured!\n" );
} else {
form.append( "\nWriting NDEF record..\n" );
conn = Connector.open( properties[0].getUrl() );
writeNDEFRecord( ((NDEFTagConnection) conn) );
form.append( "Record written!\n" );
}
} catch ( Exception e ) {
form.append( e.toString() );
e.printStackTrace();
} finally {

try {
conn.close();
} catch ( IOException e ) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
}

private String getBlockType( int type ) {
if ( type == 1 ) {
return "TRAILER";
}
if ( type == 2 ) {
return "MANUFACTURER";
}
if ( type == 3 ) {
return "DATA";
}
return "unknown";
}

private void showSectorData( MFStandardConnection conn ) throws Exception {
for ( int i = 0; i < conn.getSectorCount(); i++ ) {
System.out.println( "------------- SECTOR " + i + " -----------" );
MFSector sector = conn.getSector( i );
for ( int j = 0; j < sector.getBlockCount(); j++ ) {
MFBlock block = sector.getBlock( j );
byte[] dst = new byte[16];
block.read( null, dst, 0, 0, 16 );
System.out.println( getBlockType( block.getBlockType() ) + " = " + new String( dst ) );
}
}
}

public void commandAction( Command c, Displayable d ) {
if ( secure ) {
secure = false;
form.removeCommand( secureCommand );
form.addCommand( writeCommand );
} else {
secure = true;
form.removeCommand( writeCommand );
form.addCommand( secureCommand );
}
}

public void recordDetected( NDEFMessage message ) {
System.out.println( "Record detected! Message is " + message );
}
}

[gdspd8]

Hi Jazz66, I follow ur test code using the SDK (with Nokia 6131 NCF phone)and I cannot write to my Mifare 1K. I try secure and it can secure. Now it seem like my MiFare 1k card is totally locked. How to release my Mifare tag? Please advise. Thanks!